OutSystems maintains a low-volume vulnerability profile concentrated in its platform-as-a-service and rapid application-development tools, which sit in the request path of custom enterprise applications. The recurring weakness classes—cross-site request forgery, cross-site scripting, HTTP request smuggling, server-side request forgery, and search path manipulation—reflect the web-facing surface and request-handling complexity inherent to application platforms and development consoles that parse and process untrusted input. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Outsystems over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-47636HIGH A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Language), the application | Aug 10, 2023 | 7.8 | 29 | NO | YES |
CVE-2021-29357HIGH The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 (and LifeTime management console before 11.7.0) allows SSRF for arbitrary outbou | Apr 12, 2021 | 8.6 | 26 | NO | NO |
CVE-2025-61258HIGH Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service via a crafted content-length value mismatching the body length. NOTE: the Supplier indicates | Dec 9, 2025 | 7.5 | 24 | NO | NO |
CVE-2019-12273MEDIUM OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. NOTE: The product is self-hosted by the customer, even though it | Dec 31, 2019 | 6.5 | 20 | NO | NO |
CVE-2020-13639MEDIUM A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker t | Aug 31, 2021 | 6.1 | 17 | NO | NO |
CVE-2020-29441MEDIUM An issue was discovered in the Upload Widget in OutSystems Platform 10 before 10.0.1019.0. An unauthenticated attacker can upload arbitrary files. In some cases, this attack may co | Nov 30, 2020 | 6.5 | 17 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Outsystems.
Media articles that mention a CVE ID that affects a product developed by Outsystems — matched by CVE ID, not by vendor name.